On Sat, 11 May 2013 13:29:23 +0200
richard -rw- weinberger <richard.weinberger@gmail.com> wrote:

> On Sat, May 11, 2013 at 1:01 PM, Sergei Trofimovich <slyich@gmail.com> wrote:
> >> With this change:
> >>
> >> diff --git a/fs/namespace.c b/fs/namespace.c
> >> index 7b1ca9b..289211d 100644
> >> --- a/fs/namespace.c
> >> +++ b/fs/namespace.c
> >> @@ -2236,6 +2236,8 @@ int copy_mount_string(const void __user *data, char **where)
> >>                 return 0;
> >>         }
> >>
> >> +       printk(" here: size is %ul\n", (unsigned long)data);
> >
> > Be careful, it's long->int truncation. I guess you want '%lu' instead of '%ul'.
> 
> Erm, data is a character array...

Gah, sorry!

Toralf, it's better to use strnlen_user for it:

--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2230,12 +2230,16 @@ int copy_mount_options(const void __user * data, unsigned long *where)
 int copy_mount_string(const void __user *data, char **where)
 {
        char *tmp;
+       long data_len;

        if (!data) {
                *where = NULL;
                return 0;
        }

+       data_len = strnlen_user (data, (long)(~0ul >> 1) /* LONG_MAX */);
+       printk("%s: __user * data size is %lu\n", __func__, data_len);
+
        tmp = strndup_user(data, PAGE_SIZE);
        if (IS_ERR(tmp))
                return PTR_ERR(tmp);

-- 

  Sergei